Hello
I am new to Splunk but have found it quite useful. My question is this:
I have 2 searches that looks in the log and finds a value that is either "RealTime" or "AdvancedSale".
I have tried the search in 2 ways:
Which works but the second search finds only 1 result and lists that on result for the entire span (I run it for a 7 day period)
This works correctly but appends (which it should) the results to the end of the graph making it a long graph and not placing the two on top of each other.
Any ideas what I am doing incorrectly or what I can do to correct this?
Thank you!
I think you should ditch the second search altogether and merge it into the first instead. Then use eval statements in your timechart to separate the two.
index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings
I think you should ditch the second search altogether and merge it into the first instead. Then use eval statements in your timechart to separate the two.
index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings
One more question. I would like to know what % of of the total per day is "Advanced Sales" how can I do this using the current format? I'm pretty sure I'm making this harder than it really is.
Of course, I knew it had to be something to do with the structure. Thank for the help its greatly appreciated!